feat: Compute gMSA AES keys when using --gmsa#1125
feat: Compute gMSA AES keys when using --gmsa#1125Ne0re0 wants to merge 2 commits intoPennyw0rth:mainfrom
Conversation
Ne0re0
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
|
Hi and thanks for the PR. Nice idea, but what is 988131e about? Please also elaborate the use of AI, as requested in the PR template: |
nxc/protocols/ldap/proto_args.py
Outdated
| ggroup.add_argument("--gmsa-convert-id", help="Get the secret name of specific gmsa or all gmsa if no gmsa provided") | ||
| ggroup.add_argument("--gmsa-decrypt-lsa", help="Decrypt the gmsa encrypted value from LSA") | ||
|
|
||
| ldap_parser.add_argument( |
There was a problem hiding this comment.
Please put this all on one line
nxc/protocols/ldap.py
Outdated
|
|
||
| # Allow explicit override for cross-domain/cross-forest enumeration | ||
| if getattr(self.args, "target_domain", None): | ||
| self.baseDN = ",".join([f"DC={part}" for part in self.args.target_domain.split(".")]) |
There was a problem hiding this comment.
variable naming should by pythonic, e.g. base_dn and target_domain
nxc/protocols/ldap.py
Outdated
| ntlm_hash = MD4.new() | ||
| ntlm_hash.update(currentPassword) | ||
| passwd = hexlify(ntlm_hash.digest()).decode("utf-8") | ||
| # Compute Kerberos AES keys |
There was a problem hiding this comment.
This code is used twice but with only one different, it should be functionalized so there isn't the same code in two separate places if that is possible
There was a problem hiding this comment.
I factorized as much code as possible and removed duplicated code in the NT hash computation as well :)
|
Hi! Oops, I didn't realize commits to the same branch would sync directly to this PR. Sorry about that... The extra changes were entirely claude coded and not meant to be included. I'll revert it back to the first commit. Would you prefer a fresh PR or should we continue with this one? |
Absolutely fine to continue on in here👍 |
3 participants
Description
This PR computes both
aes128-cts-hmac-sha1-96andaes256-cts-hmac-sha1-96keys when using--gmsawithnxc ldap, provided the specified user hasReadGMSAPasswordrights over a gMSA account.This is a re-implementation of the logic from the gMSADumper tool.
Type of change
Setup guide for the review
To test this, you need a user with
ReadGMSAPasswordrights over a gMSA account. Run:Screenshots (if appropriate):
Checklist:
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)